lkml.org 
[lkml]   [2007]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: NFS4 authentification / fsuid
Date
On Sep 06, 2007, at 19:35:14, Trond Myklebust wrote:
> On Thu, 2007-09-06 at 19:30 -0400, Kyle Moffett wrote:
>> Actually, that's a fairly simple problem (barring disassembling
>> the system and attaching a hardware debugger). You encrypt the
>> root filesystem and require a password to boot (See: LUKS).
>> Debian has built-in support for installing onto fs-on-LVM-on-crypt-
>> on-RAID, and it works quite well on all the laptops I use
>> regularly. It's not even much of a speed penalty; once you take
>> the overhead of hitting a 5400RPM laptop drive you can chew
>> thousands of cycles of CPU without anybody noticing (much). Then
>> all you have to do is burn a copy of your /boot with bootloader
>> onto some read-only media (like a finalized CDROM/DVDROM) and
>> you're set to go.
>
> Disconnect battery, and watch boot password go 'poof!'.

Umm, I did say "encrypt the root filesystem", didn't I? Booting my
laptops this way follows this procedure:
1) Enter BIOS boot menu
2) Insert /boot CDROM
3) Select the "CDROM" entry
4) Wait for kernel to start and run through initramfs
5) Type password into the initramfs prompt so that it can DECRYPT
THE ROOT FILESYSTEM
6) Continue to boot the system.

Under this setup, tinkering with my BIOS does virtually nothing; the
only avenues of attack are strictly of the "Install a hardware
keylogger" variety. Without my "boot" password you are looking at a
block device which appears to be little more than a random bit-
bucket, using AES-256 encryption. If you can break that by
disconnecting the BIOS battery a lot of governments would be very
interested in the exact procedure. :-D Furthermore if I think that
the hardware has been compromised I can pull out the HDD and my CDROM
and take them to a trusted computer to gain access to my data.

That said, a useful BIOS password helps keep somebody from casually
setting a supervisor password or mucking with the critical-to-boot
settings and making _me_ unplug the battery.

Cheers,
Kyle Moffett
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-09-07 02:59    [W:0.079 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site